If you're looking for something to practice against, check out WebGoat or DVWA. Both are intentionally insecure apps. WebGoat has built in "lessons", and DVWA will give you three difficulty levels. These will give you a ton of exercises to work on...

(Keep in mind that any machine you run these on instantly becomes vulnerable, take care.)